cross-spawn 7.0.3 issue #2164

Activity

1. nschonni commented on Nov 19, 2024

   

   nschonni

   on Nov 19, 2024

   Member

   More actions

   That is likely a dependency of NPM, and we do not update the image with a version of NPM except for the one shipped by Node.js. You can see if it is addressed upstream and if it will be in an upcoming Node.js release

   https://github.com/nodejs/docker-node/blob/main/SECURITY.md

   👍React with 👍1Reacted by ACoolman
2. nschonni

   closed this as not plannedon Nov 19, 2024
3. ACoolmanTelicent commented on Nov 19, 2024

   

   ACoolmanTelicent

   on Nov 19, 2024

   More actions

   For other travellers npm/cli#7902

   👍React with 👍1Reacted by Nick Schonning

   👀React with 👀1Reacted by Evgeniy Lukoyanov
4. jeffrey-zhang commented on Dec 5, 2024

   

   jeffrey-zhang

   on Dec 5, 2024

   More actions

   NPM has released the new version to fix this. so, do we have any plan to rebuild and release our base image to include this fix.

   👍React with 👍2Reacted by ACoolman and Ng Jia Hua
5. feenst commented on Dec 12, 2024

   

   feenst

   on Dec 12, 2024

   More actions

   For scanned images where npm is needed, I can update to a version of npm where this is fixed in my Dockerfile at references a published docker-node image:

   FROM node:18-alpine
   
   RUN npm install -g npm@10.9.1

   For scanned images where npm is not needed (i.e. not part of a build process), I would just remove npm (and yarn):

   FROM node:18-alpine
   
   RUN npm uninstall npm -g \
       && rm -rf /opt/yarn-v$YARN_VERSION/ \
       && rm /usr/local/bin/yarn \
       && rm /usr/local/bin/yarnpkg \

   👍React with 👍3Reacted by ACoolman, Diego Prestes and vlinder